Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smuggling arbitrary data through an emoji

paulbutler.org

Post reply on HN
Print view View original

161–170 of 206 posts

Re: Smuggling arbitrary data through an emoji

#161

Post by llm_trw »

ethin wrote: post #157

It's worth noting, just as a curiosity, that screen readers can detect these variation selectors when I navigate by character. For example, if I arrow over the example he provided (I can't paste it here lol), I here: "Smiling face with smiling eyes", "Symbol e zero one five five", "Symbol e zero one five c", "Symbol e zero one five c", "Symbol e zero one five f". This is unfortunately dependent on the speech synthesi…

Ironically enough I have a script that strips all non-ascii characters from my screen reader because I found that _all_ online text was polluted with invisible and annoying to listen to characters.

Re: Smuggling arbitrary data through an emoji

#162

Post by jodrellblank »

riskable wrote: post #19
FranchuFranchu wrote: post #9

You could store UTF-8 encoded data inside the hidden bytestring. If some of the UTF-8 encoded smuggled characters are variation selector characters, you can smuggle text inside the smuggled text. Smuggled data can be nested arbitrarily deep.

I'm imagining post-incident analysis finding out that, "the data was exfiltrated via some Unicode string..." then they put it up on the screen and it's just an enormous line of turtle emoji https://emojipedia.org/turtle

> We and our 717 technology partners ask you to consent to the use of cookies to store and access personal data on your device.

To see a turtle emoji.

Re: Smuggling arbitrary data through an emoji

#164

Post by omnibrain »

10 years or so ago I shocked coworkers with using U+202D LEFT-TO-RIGHT OVERRIDE mid in filenames on windows. So funnypicturegnp.exe became funnypictureexe.png Combined with a custom icon for the program that mimics a picture preview it was pretty convincing.

Re: Smuggling arbitrary data through an emoji

#165

Post by hosteur »

omnibrain wrote: post #164

10 years or so ago I shocked coworkers with using U+202D LEFT-TO-RIGHT OVERRIDE mid in filenames on windows. So funnypicturegnp.exe became funnypictureexe.png Combined with a custom icon for the program that mimics a picture preview it was pretty convincing.

Wow this is a clever trick.

Re: Smuggling arbitrary data through an emoji

#166

Post by ChadNauseam »

vessenes wrote: post #152
ChadNauseam wrote: post #146

Earlier quoted context omitted.

There are other possible approaches to LLM watermarking that would be much more robust and harder to detect. They exploit the fact that LLMs work by producing a probability distribution that gives a probability for each possible next token. These are then sampled randomly to produce the output. To add fingerprints when generating, you could do some trickery in how you do that sampling that would then be detectable by…

This is not a great method in a world with closed models and highly diverse open models and samplers. It’s intellectually appealing for sure! But it will always be at best a probabilistic method, and that’s if you have the llm weights at hand.

What makes it not a good method? Of course if a model's weights are publicly available, you can't compel anyone using it to add fingerprinting at the sampler stage or later. But I would be shocked if OpenAI was not doing something like this, since it would be so easy and couldn't hurt them, but could help them if they don't want to train on outputs they generated. (Although they could also record hashes of their outputs or something similar as well – I would be surprised if they don't.)
Post reply on HN